Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
40,732 results · page 226 of 815
Dec 31, 2025Robots.txt rewrite: Cross-Site Request Forgery (CSRF)CVE-2025-62148 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Eugen Bobrowski Robots.txt rewrite robotstxt-rewrite allows Cross Site Request Forgery.This issue affects Robots.txt rewrite: from n/a through <= 1.6.1.
- Product
- Robots.txt rewrite
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update Robots.txt rewrite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Post Video Players: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-62143 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in nicashmu Post Video Players video-playlist-and-gallery-plugin allows Retrieve Embedded Sensitive Data.This issue affects Post Video Players: from n/a through <= 1.163.
- Product
- Post Video Players
- Affected
- up to 1.163
- What to do
- Affects up to 1.163. Update Post Video Players to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025FormFacade: Cross-Site Request Forgery (CSRF)CVE-2025-62133 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in manidoraisamy FormFacade formfacade allows Cross Site Request Forgery.This issue affects FormFacade: from n/a through <= 1.4.1.
- Product
- FormFacade
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update FormFacade to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Tasty Recipes Lite: Missing AuthorizationCVE-2025-62132 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Strategy11 Team Tasty Recipes Lite tasty-recipes-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tasty Recipes Lite: from n/a through <= 1.1.5.
- Product
- Tasty Recipes Lite
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update Tasty Recipes Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Tasty Recipes Lite: Missing AuthorizationCVE-2025-62131 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Strategy11 Team Tasty Recipes Lite tasty-recipes-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tasty Recipes Lite: from n/a through <= 1.1.5.
- Product
- Tasty Recipes Lite
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update Tasty Recipes Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Accordion Slider Gallery: Missing AuthorizationCVE-2025-62130 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wpdiscover Accordion Slider Gallery accordion-slider-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accordion Slider Gallery: from n/a through <= 2.7.
- Product
- Accordion Slider Gallery
- Affected
- up to 2.7
- What to do
- Affects up to 2.7. Update Accordion Slider Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025RestroPress: Missing AuthorizationCVE-2025-62129 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Magnigenie RestroPress restropress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RestroPress: from n/a through <= 3.2.7.
- Product
- RestroPress
- Affected
- up to 3.2.7
- What to do
- Affects up to 3.2.7. Update RestroPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Varnish/Nginx Proxy Caching: Insertion of Sensitive Information Into Sent DataCVE-2025-62126 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in Razvan Stanga Varnish/Nginx Proxy Caching vcaching allows Retrieve Embedded Sensitive Data.This issue affects Varnish/Nginx Proxy Caching: from n/a through <= 1.8.3.
- Product
- Varnish/Nginx Proxy Caching
- Affected
- up to 1.8.3
- What to do
- Affects up to 1.8.3. Update Varnish/Nginx Proxy Caching to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Trash Duplicate and 301 Redirect: Missing AuthorizationCVE-2025-62122 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in solwininfotech Trash Duplicate and 301 Redirect trash-duplicate-and-301-redirect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trash Duplicate and 301 Redirect: from n/a through <= 1.9.1.
- Product
- Trash Duplicate and 301 Redirect
- Affected
- up to 1.9.1
- What to do
- Affects up to 1.9.1. Update Trash Duplicate and 301 Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025AI Copilot: Missing AuthorizationCVE-2025-62116 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in quadlayers AI Copilot ai-copilot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Copilot: from n/a through <= 1.5.2.
- Product
- AI Copilot
- Affected
- up to 1.5.2
- What to do
- Affects up to 1.5.2. Update AI Copilot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Download Media Library: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-62114 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in marcelotorres Download Media Library download-media-library allows Retrieve Embedded Sensitive Data.This issue affects Download Media Library: from n/a through <= 0.2.1.
- Product
- Download Media Library
- Affected
- up to 0.2.1
- What to do
- Affects up to 0.2.1. Update Download Media Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Wiremo: Missing AuthorizationCVE-2025-62092 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Wiremo Wiremo woo-reviews-by-wiremo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wiremo: from n/a through <= 1.4.99.
- Product
- Wiremo
- Affected
- up to 1.4.99
- What to do
- Affects up to 1.4.99. Update Wiremo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Mergado Pack: Cross-Site Request Forgery (CSRF)CVE-2025-62089 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in MERGADO Mergado Pack mergado-marketing-pack allows Cross Site Request Forgery.This issue affects Mergado Pack: from n/a through <= 4.2.1.
- Product
- Mergado Pack
- Affected
- up to 4.2.1
- What to do
- Affects up to 4.2.1. Update Mergado Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Sticky Notes for WP Dashboard: Missing AuthorizationCVE-2025-62087 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Web Builder 143 Sticky Notes for WP Dashboard wb-sticky-notes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sticky Notes for WP Dashboard: from n/a through <= 1.2.4.
- Product
- Sticky Notes for WP Dashboard
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Sticky Notes for WP Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025iNext Woo Pincode Checker: Cross-Site Request Forgery (CSRF)CVE-2025-62084 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Imdad Next Web iNext Woo Pincode Checker inext-woo-pincode-checker allows Cross Site Request Forgery.This issue affects iNext Woo Pincode Checker: from n/a through <= 2.3.1.
- Product
- iNext Woo Pincode Checker
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update iNext Woo Pincode Checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Live Shopping & Shoppable Videos For WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-62080 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Channelize.io Team Live Shopping & Shoppable Videos For WooCommerce live-shopping-video-streams allows Cross Site Request Forgery.This issue affects Live Shopping & Shoppable Videos For WooCommerce: from n/a through <= 2.2.0.
- Product
- Live Shopping & Shoppable Videos For WooCommerce
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update Live Shopping & Shoppable Videos For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025WP Export Categories & Taxonomies: Missing AuthorizationCVE-2025-62079 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Damian WP Export Categories & Taxonomies wp-export-categories-taxonomies allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Export Categories & Taxonomies: from n/a through <= 1.0.3.
- Product
- WP Export Categories & Taxonomies
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update WP Export Categories & Taxonomies to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Gerencianet Oficial: Insertion of Sensitive Information Into Sent DataCVE-2025-59136 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in Efí Bank Gerencianet Oficial woo-gerencianet-official allows Retrieve Embedded Sensitive Data.This issue affects Gerencianet Oficial: from n/a through <= 3.1.3.
- Product
- Gerencianet Oficial
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update Gerencianet Oficial to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Appointify: Cross-Site Request Forgery (CSRF)CVE-2025-59130 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in appointify Appointify appointify allows Cross Site Request Forgery.This issue affects Appointify: from n/a through <= 1.0.8.
- Product
- Appointify
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Appointify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Orders Chat for WooCommerce: Missing AuthorizationCVE-2025-49356 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Mykola Lukin Orders Chat for WooCommerce orders-chat-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Orders Chat for WooCommerce: from n/a through <= 1.2.0.
- Product
- Orders Chat for WooCommerce
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Orders Chat for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Flowbox: Missing AuthorizationCVE-2025-49338 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Flowbox Flowbox flowbox allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flowbox: from n/a through <= 1.1.6.
- Product
- Flowbox
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update Flowbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025MyD Delivery: Authorization Bypass Through User-Controlled KeyCVE-2025-49334 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in Eduardo Villão MyD Delivery myd-delivery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MyD Delivery: from n/a through <= 1.7.1.
- Product
- MyD Delivery
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update MyD Delivery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Master Addons for Elementor: Authorization Bypass Through User-Controlled KeyCVE-2025-63053 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in Liton Arefin Master Addons for Elementor master-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Master Addons for Elementor: from n/a through <= 2.0.9.9.4.
- Product
- Master Addons for Elementor
- Affected
- up to 2.0.9.9.4
- What to do
- Affects up to 2.0.9.9.4. Update Master Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025EasyTest – Simplify A/B Testing: Missing AuthorizationCVE-2025-63031 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Grids EasyTest – Simplify A/B Testing convertpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EasyTest – Simplify A/B Testing: from n/a through 1.0.1.
- Product
- EasyTest – Simplify A/B Testing
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update EasyTest – Simplify A/B Testing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Simple Like Page: Missing AuthorizationCVE-2025-63022 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in topdevs.net Simple Like Page simple-facebook-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Like Page: from n/a through <= 1.5.3.
- Product
- Simple Like Page
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update Simple Like Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025QuadLayers TikTok Feed: Missing AuthorizationCVE-2025-63016 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in quadlayers QuadLayers TikTok Feed wp-tiktok-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects QuadLayers TikTok Feed: from n/a through <= 4.6.5.
- Product
- QuadLayers TikTok Feed
- Affected
- up to 4.6.5
- What to do
- Affects up to 4.6.5. Update QuadLayers TikTok Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Hotel Booking: Missing AuthorizationCVE-2025-63001 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in nicdark Hotel Booking nd-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hotel Booking: from n/a through <= 3.8.
- Product
- Hotel Booking
- Affected
- up to 3.8
- What to do
- Affects up to 3.8. Update Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025WP Attachments: Missing AuthorizationCVE-2025-62888 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Marco Milesi WP Attachments wp-attachments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Attachments: from n/a through <= 5.2.
- Product
- WP Attachments
- Affected
- up to 5.2
- What to do
- Affects up to 5.2. Update WP Attachments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Realbig: Missing AuthorizationCVE-2025-62147 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in nikmelnik Realbig realbig-media allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Realbig: from n/a through <= 1.1.3.
- Product
- Realbig
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Realbig to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025DMCA Protection Badge: Missing AuthorizationCVE-2025-62145 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in NewClarity DMCA Protection Badge dmca-badge allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DMCA Protection Badge: from n/a through <= 2.2.0.
- Product
- DMCA Protection Badge
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update DMCA Protection Badge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Wawp: Missing AuthorizationCVE-2025-62141 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Information Technology Wawp automation-web-platform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wawp: from n/a through <= 4.4.
- Product
- Wawp
- Affected
- up to 4.4
- What to do
- Affects up to 4.4. Update Wawp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Terms descriptions: Insertion of Sensitive Information Into Sent DataCVE-2025-62139 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in Vladimir Statsenko Terms descriptions terms-descriptions allows Retrieve Embedded Sensitive Data.This issue affects Terms descriptions: from n/a through <= 3.4.10.
- Product
- Terms descriptions
- Affected
- up to 3.4.10
- What to do
- Affects up to 3.4.10. Update Terms descriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Add Custom Codes: Missing AuthorizationCVE-2025-62108 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in SaifuMak Add Custom Codes add-custom-codes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Add Custom Codes: from n/a through <= 4.80.
- Product
- Add Custom Codes
- Affected
- up to 4.80
- What to do
- Affects up to 4.80. Update Add Custom Codes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Portfolio Gallery: Missing AuthorizationCVE-2025-62098 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in totalsoft Portfolio Gallery gallery-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Portfolio Gallery: from n/a through <= 1.4.8.
- Product
- Portfolio Gallery
- Affected
- up to 1.4.8
- What to do
- Affects up to 1.4.8. Update Portfolio Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Serial Codes Generator and Validator with WooCommerce Support: Missing AuthorizationCVE-2025-62091 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Vollstart Serial Codes Generator and Validator with WooCommerce Support serial-codes-generator-and-validator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Serial Codes Generator and Validator with WooCommerce Support: from n/a through <= 2.8.2.
- Product
- Serial Codes Generator and Validator with WooCommerce Support
- Affected
- up to 2.8.2
- What to do
- Affects up to 2.8.2. Update Serial Codes Generator and Validator with WooCommerce Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Live Shopping & Shoppable Videos For WooCommerce: Missing AuthorizationCVE-2025-62081 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Channelize.io Team Live Shopping & Shoppable Videos For WooCommerce live-shopping-video-streams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Live Shopping & Shoppable Videos For WooCommerce: from n/a through <= 2.2.0.
- Product
- Live Shopping & Shoppable Videos For WooCommerce
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update Live Shopping & Shoppable Videos For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Reuters Direct: Missing AuthorizationCVE-2025-49349 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Reuters News Agency Reuters Direct reuters-direct allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Reuters Direct: from n/a through <= 3.0.0.
- Product
- Reuters Direct
- Affected
- up to 3.0.0
- What to do
- Affects up to 3.0.0. Update Reuters Direct to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Postie: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63020 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wayne Allen Postie postie allows Stored XSS.This issue affects Postie: from n/a through <= 1.9.73.
- Product
- Postie
- Affected
- up to 1.9.73
- What to do
- Affects up to 1.9.73. Update Postie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025WooCommerce Parcelas: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62750 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Filipe Seabra WooCommerce Parcelas woocommerce-parcelas allows DOM-Based XSS.This issue affects WooCommerce Parcelas: from n/a through <= 1.3.5.
- Product
- WooCommerce Parcelas
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update WooCommerce Parcelas to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Add Custom Codes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62149 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SaifuMak Add Custom Codes add-custom-codes allows Stored XSS.This issue affects Add Custom Codes: from n/a through <= 4.80.
- Product
- Add Custom Codes
- Affected
- up to 4.80
- What to do
- Affects up to 4.80. Update Add Custom Codes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Core Web Vitals & PageSpeed Booster: Missing AuthorizationCVE-2025-62144 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Mohammed Kaludi Core Web Vitals & PageSpeed Booster core-web-vitals-pagespeed-booster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Core Web Vitals & PageSpeed Booster: from n/a through <= 1.0.28.
- Product
- Core Web Vitals & PageSpeed Booster
- Affected
- up to 1.0.28
- What to do
- Affects up to 1.0.28. Update Core Web Vitals & PageSpeed Booster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Post Video Players: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62142 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicashmu Post Video Players video-playlist-and-gallery-plugin allows Stored XSS.This issue affects Post Video Players: from n/a through <= 1.163.
- Product
- Post Video Players
- Affected
- up to 1.163
- What to do
- Affects up to 1.163. Update Post Video Players to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Locatoraid Store Locator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62140 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in plainware Locatoraid Store Locator locatoraid allows Stored XSS.This issue affects Locatoraid Store Locator: from n/a through <= 3.9.68.
- Product
- Locatoraid Store Locator
- Affected
- up to 3.9.68
- What to do
- Affects up to 3.9.68. Update Locatoraid Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025WP Advanced PDF: Missing AuthorizationCVE-2025-62138 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in cedcommerce WP Advanced PDF wp-advanced-pdf allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Advanced PDF: from n/a through <= 1.1.7.
- Product
- WP Advanced PDF
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update WP Advanced PDF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Contact Form Widget: Cross-Site Request Forgery (CSRF)CVE-2025-62134 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in A WP Life Contact Form Widget new-contact-form-widget allows Cross Site Request Forgery.This issue affects Contact Form Widget: from n/a through <= 1.5.1.
- Product
- Contact Form Widget
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update Contact Form Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025WP Post Signature: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62124 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Soli WP Post Signature wp-post-signature allows Stored XSS.This issue affects WP Post Signature: from n/a through <= 0.4.1.
- Product
- WP Post Signature
- Affected
- up to 0.4.1
- What to do
- Affects up to 0.4.1. Update WP Post Signature to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Logo Slider , Logo Carousel , Logo showcase , Client Logo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62121 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Emu Logo Slider , Logo Carousel , Logo showcase , Client Logo tc-logo-slider allows Stored XSS.This issue affects Logo Slider , Logo Carousel , Logo showcase , Client Logo: from n/a through <= 1.8.1.
- Product
- Logo Slider , Logo Carousel , Logo showcase , Client Logo
- Affected
- up to 1.8.1
- What to do
- Affects up to 1.8.1. Update Logo Slider , Logo Carousel , Logo showcase , Client Logo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025OpenHook: Cross-Site Request Forgery (CSRF)CVE-2025-62120 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Rick Beckman OpenHook thesis-openhook allows Cross Site Request Forgery.This issue affects OpenHook: from n/a through <= 4.3.1.
- Product
- OpenHook
- Affected
- up to 4.3.1
- What to do
- Affects up to 4.3.1. Update OpenHook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Add Featured Image Custom Link: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62119 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ViitorCloud Technologies Pvt Ltd Add Featured Image Custom Link custom-url-to-featured-image allows DOM-Based XSS.This issue affects Add Featured Image Custom Link: from n/a through <= 2.0.0.
- Product
- Add Featured Image Custom Link
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Add Featured Image Custom Link to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025EasyIndex: Cross-Site Request Forgery (CSRF)CVE-2025-62117 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Jayce53 EasyIndex easyindex allows Cross Site Request Forgery.This issue affects EasyIndex: from n/a through <= 1.1.1704.
- Product
- EasyIndex
- Affected
- up to 1.1.1704
- What to do
- Affects up to 1.1.1704. Update EasyIndex to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.